manpages: configuration for user namespace, x11

2 files changed, 12 insertions, 6 deletions

diff --git a/src/man/firejail-profile.txt b/src/man/firejail-profile.txt
index 283b4ba15..bc8067f91 100644
--- a/src/man/firejail-profile.txt
+++ b/src/man/firejail-profile.txt
@@ -401,10 +401,12 @@ Sets the NO_NEW_PRIVS prctl.  This ensures that child processes
 cannot acquire new privileges using execve(2);  in particular,
 this means that calling a suid binary (or one with file capabilities)
 does not result in an increase of privilege.
+#ifdef HAVE_USERNS
 .TP
 \fBnoroot
 Use this command  to enable an user namespace. The namespace has only one user, the current user.
 There is no root account (uid 0) defined in the namespace.
+#endif
 .TP
 \fBprotocol protocol1,protocol2,protocol3
 Enable protocol filter. The filter is based on seccomp and  checks the
@@ -443,6 +445,7 @@ Enable seccomp filter and whitelist the system calls in the list for 32 bit syst
 Return a different error instead of EPERM to the process, kill it when
 an attempt is made to call a blocked system call, or allow but log the
 attempt.
+#ifdef HAVE_X11
 .TP
 \fBx11
 Enable X11 sandboxing.
@@ -476,7 +479,7 @@ Example:
 xephyr-screen 640x480
 .br
 x11 xephyr
-
+#endif
 .SH DBus filtering
 
 Access to the session and system DBus UNIX sockets can be allowed, filtered or
diff --git a/src/man/firejail.txt b/src/man/firejail.txt
index 5c4947694..8951dd25f 100644
--- a/src/man/firejail.txt
+++ b/src/man/firejail.txt
@@ -137,8 +137,9 @@ $ firejail --appimage krita-3.0-x86_64.appimage
 .br
 $ firejail --appimage --private krita-3.0-x86_64.appimage
 .br
+#ifdef HAVE_X11
 $ firejail --appimage --net=none --x11 krita-3.0-x86_64.appimage
-
+#endif
 .TP
 \fB\-\-audit
 Audit the sandbox, see \fBAUDIT\fR section for more details.
@@ -1029,8 +1030,10 @@ $ firejail \-\-list
 .br
 7056:netblue:torrent:firejail \-\-net=eth0 transmission-gtk
 .br
+#ifdef HAVE_USERNS
 7064:netblue::firejail \-\-noroot xterm
 .br
+#endif
 .TP
 \fB\-\-ls=name|pid dir_or_filename
 List files in sandbox container, see \fBFILE TRANSFER\fR section for more details.
@@ -1514,7 +1517,7 @@ Parent pid 8553, child pid 8554
 Child process initialized
 .br
 [...]
-
+#if HAVE_USERNS
 .TP
 \fB\-\-noroot
 Install a user namespace with a single user - the current user.
@@ -1538,7 +1541,7 @@ $ ping google.com
 ping: icmp open socket: Operation not permitted
 .br
 $
-
+#endif
 .TP
 \fB\-\-nosound
 Disable sound system.
@@ -2684,7 +2687,7 @@ Example:
 .br
 $ sudo firejail --writable-var-log
 
-
+#ifdef HAVE_X11
 .TP
 \fB\-\-x11
 Sandbox the application using Xpra, Xephyr, Xvfb or Xorg security extension.
@@ -2845,7 +2848,7 @@ Example:
 .br
 $ firejail --net=eth0 --x11=xephyr --xephyr-screen=640x480 firefox
 .br
-
+#endif
 #ifdef HAVE_APPARMOR
 .SH APPARMOR
 .TP